high · 7.8CVE-2026-70354Aug 11, 2026

CVE-2026-70354: .NET WPF Out-of-Bounds Write Remote Code Execution

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A crafted file opened in a WPF application can trigger an out-of-bounds memory write in the .NET Windows Presentation Foundation runtime, letting an attacker run arbitrary code as the current user.

PackageMicrosoft.WindowsDesktop.App.Runtime.win-arm64
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.10
Fixed in10.0.11
CVE-2026-70354: .NET WPF Out-of-Bounds Write Remote Code Execution

The problem

Windows Presentation Foundation (WPF) in .NET 8, 9, and 10 contains a CWE-787 out-of-bounds write. The flaw lives in the native WPF rendering or parsing layer on Windows.

Because the attack vector is local and requires user interaction (CVSS AV:L/UI:R), the practical scenario is a victim opening a specially crafted document or image in a WPF application. A successful exploit gives the attacker full code execution at the privilege level of the logged-in user, with high impact to confidentiality, integrity, and availability.

The fix

Update the WindowsDesktop runtime to a patched version: .NET 10.0.11, .NET 9.0.19, or .NET 8.0.30. Run dotnet --info to check installed versions. Self-contained WPF applications must be recompiled against the patched SDK and redeployed. Visual Studio users will be prompted to update automatically.

Reporter not attributed.

References: [1][2][3][4][5]

Related research